// Shared customer-workspace (tenant) domain types for the /admin surface.
// These mirror the platform-api schemas (Tenant, Subscription, AuditEvent) as
// they serialize over /api/me and /api/tenants/:slug/*. View-models the admin
// pages bind to are derived from these in the page/composable layer.

export type TenantStatus = 'pending' | 'active' | 'suspended' | 'deleted'
export type PlanKey = 'mvp' | 'pro' | 'enterprise'

// Company/tax info stored on the tenant for invoicing.
export interface TenantBillingInfo {
  companyName?: string
  vatId?: string
  country?: string
  contactEmail?: string
}

// Customer security policy (stored intent; enforcement wired incrementally).
export interface TenantSecurityPolicy {
  mfaMode: 'all' | 'admins' | 'optional'
  sessionIdleMinutes?: number
  sessionAbsoluteHours?: number
  allowedCountries?: string[]
  ipAllowlist?: string[]
}

// Live MFA-enrollment overview from GET /tenants/:slug/mfa-status.
export interface MfaStatus {
  total: number
  enrolled: number
  members: Array<{ id: string; name: string; email: string; role: string; enrolled: boolean }>
}

// An SSO app (Dezky as IdP) from GET /tenants/:slug/sso-apps.
export interface SsoApp {
  id: string
  name: string
  protocol: 'oidc' | 'saml'
  clientId?: string
  redirectUris: string[]
  issuer?: string
  wellKnownUrl?: string
  createdAt?: string
}
// POST response also carries the one-time client secret.
export interface SsoAppCreated extends SsoApp {
  clientSecret: string
}

// A tenant as returned by GET /tenants (findByIds for the signed-in user).
export interface TenantDoc {
  _id: string
  slug: string
  name: string
  status: TenantStatus
  plan?: PlanKey
  // Seat count carried on the tenant (portfolio displays). The billed seat
  // limit lives on the Subscription; prefer that for license math.
  seats?: number
  domains?: string[]
  industry?: string
  brandColor?: string
  billingInfo?: TenantBillingInfo
  securityPolicy?: TenantSecurityPolicy
  createdAt?: string
  updatedAt?: string
}

export type SubscriptionStatus =
  | 'trialing'
  | 'active'
  | 'past_due'
  | 'canceled'
  | 'incomplete'
  | 'incomplete_expired'

// A subscription as returned by GET /subscriptions (one per tenant).
export interface SubscriptionDoc {
  _id: string
  tenantId: string
  plan: PlanKey
  cycle: 'monthly' | 'quarterly' | 'yearly'
  currency: 'DKK' | 'EUR' | 'USD'
  // Per-seat amount in `currency`, snapshotted at provision time. Plain number.
  perSeatAmount: number
  // Billed seat count (the license limit).
  seats: number
  status: SubscriptionStatus
  currentPeriodEnd?: string
  trialEndsAt?: string
  canceledAt?: string
}

// A user row as returned by GET /tenants/:slug/users (UserDocument). Only the
// fields the customer-admin surface actually renders are typed here.
export interface TenantUserDoc {
  _id: string
  email: string
  name: string
  // Legacy global role. Prefer `tenantRole` (the role for THIS workspace) when
  // present — GET /tenants/:slug/users and the member PATCH both return it.
  role: 'owner' | 'admin' | 'member'
  tenantRole?: 'owner' | 'admin' | 'member'
  active: boolean
  lastLoginAt?: string
  createdAt?: string
  // Present when the user has a provisioned Stalwart mailbox (i.e. can receive
  // mail / be an alias destination). Absent for SSO-only users.
  mailboxAddress?: string
  // Set alongside mailboxAddress when a Stalwart account backs the mailbox.
  stalwartAccountId?: string
  // Directory profile (O365-style "Kontaktoplysninger"), editable in the drawer.
  firstName?: string
  lastName?: string
  phone?: string
  alternativeEmail?: string
}

// GET/POST/DELETE /tenants/:slug/users/:userId/aliases response.
export interface MemberAliases {
  hasMailbox: boolean
  primary: string
  aliases: string[]
}

// The card on file, as returned by GET /tenants/:slug/payment-method (null when
// none). Card data lives in Stripe — we only ever surface these display bits.
export interface PaymentMethodCard {
  brand: string
  last4: string
  expMonth: number
  expYear: number
}

// An invoice as returned by GET /tenants/:slug/invoices. Amounts in MINOR units.
export interface InvoiceDoc {
  _id: string
  number?: string
  currency: 'DKK' | 'EUR' | 'USD'
  amountDue: number
  amountPaid: number
  status: 'draft' | 'open' | 'paid' | 'void' | 'uncollectible' | 'past_due'
  periodStart?: string
  periodEnd?: string
  hostedInvoiceUrl?: string
  pdfUrl?: string
  createdAt?: string
}

// An email-template override (customer's edited copy of a template).
export interface EmailTemplateOverride {
  key: string
  subject: string
  body: string
}

// Whitelabel branding as returned by GET /tenants/:slug/branding. name +
// brandColor come from the Tenant doc; emailTemplates are the saved overrides.
export interface TenantBrandingView {
  name: string
  brandColor?: string
  primaryDomain?: string
  emailTemplates: EmailTemplateOverride[]
}

// A raw audit event as returned by GET /tenants/:slug/audit.
export interface AuditEventDoc {
  _id: string
  at: string
  actorType: 'user' | 'system'
  actorEmail?: string
  actorIp?: string
  action: string
  outcome: 'success' | 'failure'
  resourceType?: string
  resourceId?: string
  resourceName?: string
}
